Data Processing Addendum

1 Standard Terms

This DPA incorporates the Bonterms Data Protection Addendum, Version 2.0 (Attachment Version). The sections below are its DPA Details. Capitalised terms have the meaning given there or in the Main Agreement.

2 Key Terms

• Main Agreement: the end user agreement that governs your use of the app obtained through the Atlassian Marketplace.
• DPA Effective Date: the date you first accept the Main Agreement.
• Subprocessor List: section 5 below.
• Designated EU Governing Law and Member State: the EU member state where Customer is established. If Customer is not established in the EU, Ireland.

3 Parties

• Customer (Data Exporter): the organisation that installs the app. Role: Controller. Details as given in its Atlassian Marketplace order.
• Provider (Data Importer): Reinwok. Role: Processor. Activities: development, maintenance and support of apps for Atlassian products.
• Data protection contact: [email protected]. Provider's legal name and registered address are provided on request.

4 Details of Processing

• Data subjects: Customer's end users of the app, including its employees and contractors.
• Personal data: Atlassian account IDs; custom events; calendars and their configuration.
• Special categories: none. Do not enter special categories of personal data into the app.
• Frequency of transfer: continuous.
• Nature of the processing: storage, retrieval and display of the data within your Atlassian cloud site, as required to provide the app.
• Purpose: to provide the app and carry out Customer Instructions.
• Duration: the term of the Main Agreement, then as set out in Section 8 (Data Return or Deletion) of the standard terms.
• Competent EU supervisory authority: as determined under Clause 13 of the EU SCCs.

5 Subprocessor List

• Atlassian Pty Ltd and its affiliates, with their subprocessors. Purpose: hosting the app on the Atlassian Forge platform (compute, database and storage). Location: the hosting location of your Atlassian cloud site.

Our support staff work under written confidentiality terms. They cannot access data held in the app and see only what you choose to include in a support request.

6 Technical and Organizational Measures

Our Security Measures are described in our Security Policy. In summary:

• The app runs on Atlassian Forge. Customer Personal Data is held in Forge hosted storage on Atlassian's infrastructure and is not sent to systems operated by Provider or by any third party other than Atlassian.
• Hosting, encryption in transit and at rest, backup, tenant isolation and physical security are provided by Atlassian.
• Provider cannot directly access data held in Forge hosted storage. Provider can view application logs through the Atlassian developer console unless your administrator disables log sharing.
• Accounts used to build, publish and support the app use unique passwords and multi-factor authentication.
• Changes are tested in a separate environment before release and can be rolled back.

7 Additional Terms

These terms modify the standard terms and control if there is a conflict.

• Hosting audits: the app is hosted entirely on Atlassian's infrastructure and Provider operates no data centres. For the hosting environment, Provider meets Section 9 (Audits) by making available the audit reports and certifications that Atlassian publishes or provides to Provider.
• Deletion: when you uninstall the app, Customer Personal Data held in Forge hosted storage is deleted by Atlassian under the Forge Terms. Provider holds no separate copy.